Virus scanners traditionally provide off-access virus scanning, e.g., a file is scanned when it is not in use. Typically scanning is performed at an off-peak time, such as during the night, when it is most likely that all files will be available for review by the scanning software. Unfortunately, the advent of fast Internet connection, and the proliferation of computers in the workplace and home, allows the users to obtain and share files much faster than the traditional virus scanners can scan and correct viruses. Consequently, off-peak scanning services are no longer sufficient.
To compensate, on-access scanning has been developed. In on-access scanning, as the name suggests, a file is scanned when access is attempted to the file. This scanning may be performed along with traditional scanning services. On-access scanning operates by configuring an operating system (or equivalent control program) to notify the on-access software when a file access attempt is made. For example, file access subroutines of the operating system may be replaced with specialized versions tailored to interact with on-access scanning software. Or, in an event driven environment, the operating system (or equivalent event-control structure) can be instructed to route file access events to the scanning software. In either configuration (or equivalents), file access attempts are effectively intercepted by the scanning software to provide an opportunity to scan the file for viruses before a file requestor obtains access to the file.
Unfortunately, there are several problems with on-access scanning. One such problem is the balancing of security needs against causing file-access errors or otherwise overly-delaying access to a file. For security, a file should be scanned before being released to a requestor. Since file access attempts are intercepted, a user requesting the file must therefore wait for scanning to complete before access is granted. If the wait is too long, the user may believe that there has been a software and/or hardware malfunction. Similarly, if the requester is another program, the program may believe there has been some sort of input/output (I/O) or other error.
To provide an appropriate balance to the foregoing problem, on-access virus scanning techniques have been developed to afford a maximum amount of security while minimizing the amount of system resources used to provide such security. One example of such techniques is to conditionally scan files based on a type of file that is being released to a requester. It is known that executable files and macro files are more susceptible to virus propagation with respect to data files, e.g. image files, text files, etc. As such, scanners have been configured to allow certain files such as data files to be released with less security measures than executable and macro files.
This exemplary prior art technique, however, fails to take into account other factors that may be useful in determining whether more or less security measures are required. For instance, present techniques fail to take into account the manner in which various program-implemented processes access files. While some of such processes commonly open files that are requested, some merely provide rudimentary forms of access such as indexing or the like. As such, different levels of security may be necessary for opening files under different processes. There is therefore a need for a system that uses resources more efficiently during virus scanning by taking more into account than just the types of files being accessed, etc.
Such a technique of analyzing processes would, however, require additional resources in and of itself. As mentioned earlier, such resources must be conserved, especially during on-access scanning. There is thus a further need for a system that takes more into account than just the types of files being accessed, wherein such system does so without excessive use of resources.